How to fix Windows update error 0x80888002?

Error 0x80888002 stops a Windows 11 upgrade when Setup cannot finish its check of whether your PC may run Windows 11. In most reported cases an old TPM bypass left a registry key or a WMI filter behind that breaks the check. Remove those leftovers first, then check the PC against Microsoft's requirements.

Facts checked on 15 October 2026. Steps written for Windows 11 25H2 and 26H2 and Windows 10 22H2 as the starting system, with Windows 11 26H2 Setup from Microsoft's download page.

What error code 0x80888002 - 0x40008 means

Windows Setup reports a failure as two codes joined by a dash. Microsoft calls the first one the result code, which says what went wrong, and the second one the extend code, which says in which phase and operation it happened. The full window reads: Setup has encountered a critical error. Sorry, we're having trouble determining if your PC can run Windows 11. Please close Setup and try again. Error code: 0x80888002 - 0x40008.

Why Windows 11 Setup stops with 0x80888002

Microsoft has not published a cause. The ranking below joins the Setup log lines with what users and volunteer moderators report on Microsoft Q&A and the ElevenForum. Each cause points to a fix.

Where setupact.log shows the real cause of 0x80888002

You do not need the log for Fix 1. Read it when Fix 1 and Fix 2 did not help. Microsoft names setupact.log the most important log for diagnosing Setup issues, and puts it in $Windows.~BT\Sources\Panther on the system drive during an upgrade.

1. Press Win + R, type %SystemDrive%\$WINDOWS.~BT\Sources\Panther and press Enter. The folder is hidden, but the path opens it.
2. Copy setupact.log and setuperr.log to your desktop, so a later fix cannot delete them.
3. Open the copy of setupact.log in Notepad, press Ctrl + End, then Ctrl + F, choose Up and search for 80888002.
4. Read the lines just above the last hit. Lines that start with CONX come from the compatibility appraiser, and MOUPG lines come from the upgrade engine.

How to fix error 0x80888002 in Windows 11 Setup and Windows Update

Fix 1 removes the leftovers that cause most cases and takes five minutes. Fix 2 and Fix 3 check and turn on the hardware that Windows 11 needs. Fix 4 replaces modified media with Microsoft's own tools. Fix 5 and Fix 6 are generic repairs for a supported PC that fails only in Windows Update.

Fix 1. Remove the leftovers of the Skip TPM Check bypass

5 minutesRead the warningAnyone who ever used a script, a tool or a registry change to get Windows 11 past its hardware check, and anyone who bought the PC used.

Old versions of the "Skip TPM Check on Dynamic Update" script blocked vdsldr.exe through Image File Execution Options or added a WMI event filter. Setup's compatibility scan then cannot finish and reports 0x80888002. A volunteer moderator's answer with these two commands is the accepted solution on Microsoft Q&A, marked helpful by more than 100 people.

1. Type cmd in the search box, right-click Command Prompt, select Run as administrator and then Yes.
2. Delete the key that versions 2 to 5 of the script created:

   reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vdsldr.exe" /f

3. Delete the key and the helper file that version 13 creates. ERROR: The system was unable to find the specified registry key or value only means it was not there:

   reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SetupHost.exe" /f
   del /f /q C:\Scripts\get11.cmd

4. Remove the policy value that turns off safeguard holds, if a tool set it:

   reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWUfBSafeguards /f

5. Type powershell and press Enter. Then delete the WMI filter of version 1. If nothing is printed, the filter was not there:

   Get-CimInstance -Namespace root/subscription -ClassName __EventFilter -Filter "Name='Skip TPM Check on Dynamic Update'" | Remove-CimInstance

6. Type exit to return to Command Prompt and delete Setup's work folder from the failed attempt. Copy the logs first if you want them:

   rd /s /q "%SystemDrive%\$WINDOWS.~BT"

7. Restart the PC and start the upgrade again in the same way as before.

Older guides use the wmic command for step 5. Microsoft has removed WMIC from supported versions of Windows 11, so the PowerShell line does the same job. Microsoft says WMI itself is not affected.

Fix 2. Check the PC with PC Health Check, tpm.msc and System Information

5 minutesNo riskEveryone after Fix 1, and anyone who does not know whether the PC meets the Windows 11 requirements.

0x80888002 means Setup could not decide whether the PC qualifies. Microsoft recommends PC Health Check to verify the requirements before an upgrade. Its answer tells you whether to turn on a setting (Fix 3) or whether the hardware itself is the limit.

1. On Windows 10, download PC Health Check from Microsoft's Windows 11 page, install it and select Check now.
2. Read each line. A green tick means the requirement is met. A red line names what is missing: TPM 2.0, Secure Boot, the processor, memory or storage.
3. Press Win + R, type tpm.msc and press Enter. Under TPM Manufacturer Information, Specification Version must be 2.0.
4. Press Win + R, type msinfo32 and press Enter. In System Summary, read BIOS Mode and Secure Boot State.
5. Compare your processor with Microsoft's list of supported processors, linked from the Windows 11 specifications page.

Fix 3. Turn on TPM 2.0 and Secure Boot in the UEFI firmware

15 minutesRead the warningPC Health Check, tpm.msc or System Information says that TPM 2.0 or Secure Boot is off, and BIOS Mode shows UEFI.

Microsoft explains that many PCs have a TPM 2.0 that is simply turned off in the firmware. Once it is on, Setup's check can pass without any bypass, so the cause of 0x80888002 is gone for good.

1. On Windows 11, open Settings > System > Recovery and select Restart now next to Advanced startup. On Windows 10, open Settings > Update & Security > Recovery and select Restart now under Advanced startup.
2. Select Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.
3. Find the TPM option. Microsoft lists these names: Security Device, Security Device Support, TPM State, AMD fTPM switch, AMD PSP fTPM, Intel PTT and Intel Platform Trust Technology.
4. Set it to Enabled.
5. Find Secure Boot, usually under Boot or Security, and set it to Enabled.
6. Save the changes, usually with F10, and let Windows start.
7. Run PC Health Check again, then the upgrade.

Fix 4. Upgrade with Microsoft's own tools instead of modified media

1 to 2 hours, mostly waitingLow riskYou install from a Rufus stick with bypass options, an image built with UUP dump, or with setup.exe /product server, on a PC that meets the requirements.

Modified media skips or patches Setup's own checks, and users report the same 0x80888002 - 0x40008 with such media on Windows 11 24H2 and later. Microsoft's unmodified tools run the check as designed, which a supported PC passes.

1. Back up the files you cannot lose: Back up your files (Windows Backup, File History, Time Machine).
2. Open Settings > Windows Update (on Windows 10, Settings > Update & Security > Windows Update) and select Check for updates. Microsoft recommends this route first.
3. If Windows 11 is not offered, open Microsoft's Download Windows 11 page and use Windows 11 Installation Assistant. It needs Windows 10 version 2004 or later and 9 GB of free space.
4. Or download the ISO from the same page, right-click it, select Mount and double-click setup.exe without any extra switches.
5. On Ready to install, keep Keep personal files and apps unless you want a clean start, and select Install.

Fix 5. Reset the Windows Update components

10 minutesLow riskThe PC passes PC Health Check, no bypass was ever used, and the error appears only as a failed feature update in Windows Update.

Windows Update downloads Setup and its compatibility data into its own cache. A damaged download in SoftwareDistribution can make the scan fail the same way each time, and a reset makes Windows download everything again.

The reset stops the update services, renames the update cache folders and starts the services again. Step by step: Reset Windows Update components.

1. Open Command Prompt as administrator. Type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Stop the update services. Type the commands below and press Enter after each one. If Windows says that other services depend on Cryptographic Services, it stops them too. A message that a service is not started is fine.

   net stop wuauserv
   net stop bits
   net stop cryptsvc

3. Delete the download queue files. This clears the list of downloads that the Background Intelligent Transfer Service keeps. If Windows says it cannot find the files, continue.

   del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"

4. Rename the update cache folders. Renaming keeps a copy in case you need it; Windows creates new, empty folders when the services start again. If you get Access is denied, a service is still running: repeat the previous step.

   ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
   ren %systemroot%\System32\catroot2 catroot2.old

5. Start the services again. Type the commands below and press Enter after each one. The requested service has already been started is fine: Windows started it on its own.

   net start cryptsvc
   net start bits
   net start wuauserv

6. Restart and check for updates. Restart the PC. Then select Start > Settings > Windows Update > Check for updates. The first check can take longer than usual because everything is downloaded again.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Reset Windows Update components

Fix 6. Repair Windows system files with DISM and SFC

15 to 30 minutesLow riskFix 5 did not help on a supported PC, or SFC finds problems on its own.

The compatibility scan runs from the Windows you are upgrading. If its system files are damaged, Setup can fail before it decides anything. DISM repairs the component store, and SFC then replaces damaged files from it.

Run DISM first, then SFC, from an administrator Command Prompt. Step by step: Run DISM and SFC to repair Windows system files.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

If error 0x80888002 is still there

When all six fixes fail, the answer is in setupact.log. Copy it from C:\$WINDOWS.~BT\Sources\Panther right after the next failed attempt, because Fix 1 and Disk Cleanup delete that folder.

• What to send to support: both codes, the exact message, how you started Setup, and the result of PC Health Check.
• Attach setupact.log and setuperr.log, and say whether a bypass tool was ever used on the PC.
• Name the processor model, the Windows version you upgrade from and the version you upgrade to.

How to keep 0x80888002 from coming back

Once Windows 11 runs, keep it updated. If a monthly update later fails with its own code on a PC that was upgraded from an older version, read our guide to Windows update error 0x800f0993.

Frequently asked questions

What does error code 0x80888002 - 0x40008 mean?

It means Windows 11 Setup could not finish its check of whether your PC may run Windows 11. The full message reads "Sorry, we're having trouble determining if your PC can run Windows 11. Please close Setup and try again." Microsoft does not list 0x80888002 in its upgrade error documentation. Setup logs from affected PCs show it in the compatibility appraiser and the system requirements scan. The second code, 0x40008, maps to phase 4 and operation 8 in Microsoft's table, which was written for Windows 10 version 1607. Start with Fix 1, because old bypass leftovers are the most reported cause.

Is 0x80888002 a Windows Update error or a Setup error?

Both. Windows Update installs a new Windows version by running the same Setup in the background, so the same failed check shows up in two places. In Windows Update it reads "We couldn't install this update, but you can try again (0x80888002)", often at a low download percentage. In Setup started from an ISO, the Media Creation Tool or the Installation Assistant, it shows the critical error window with 0x80888002 - 0x40008. The fixes are the same, and Fix 1 comes first in both cases.

What is vdsldr.exe and why does deleting its registry key help?

vdsldr.exe is a Windows file of the Virtual Disk Service. Versions 2 to 5 of the "Skip TPM Check on Dynamic Update" script added a key for it under Image File Execution Options, so Windows ran something else instead of that file during the upgrade. Deleting the key lets the file run normally again. Setup's compatibility scan can then finish, and the 0x80888002 error is gone. The key is safe to delete, but back up Image File Execution Options first, as Fix 1 shows.

Can I still bypass the TPM check to install Windows 11?

We do not give bypass steps, and Microsoft does not support them. Microsoft's support page says installing Windows 11 on a PC that misses the requirements is not recommended. Such PCs are not guaranteed updates, including security updates, and Microsoft recommends going back to Windows 10 after such an install. Bypass tools are also the most reported cause of 0x80888002 itself. If the TPM is only turned off, Fix 3 turns it on and no bypass is needed.

Does the AllowUpgradesWithUnsupportedTPMOrCPU registry value still work?

We could not find it on Microsoft's current support page. The page "Ways to install Windows 11", updated on 4 February 2025, now says it describes only installs on PCs that meet the requirements, and it no longer describes a registry way around the check. A user on the ElevenForum had the value set and still got 0x80888002 - 0x40008 when upgrading to 24H2. Do not rely on it, and do not expect support for a PC upgraded this way.

My PC passes PC Health Check. Why do I still get 0x80888002?

Because the check is blocked, not failed. A bypass left on the PC from an earlier upgrade, or by a previous owner, stops Setup's compatibility scan even when the hardware is fine. The original Microsoft Q&A thread came from such a case: an 11th generation Intel laptop that could not install 22H2 through Windows Update. Run Fix 1, restart and try again. If no leftover is found, reset Windows Update (Fix 5) and use the Installation Assistant (Fix 4).

I get the same error again after every fix. What now?

Read setupact.log right after the next failed attempt, as the section on the log shows. It names what the scan tripped over. Look in Image File Execution Options for any other key named after a Setup file. Check the PC once more with PC Health Check. If the processor or the board is the limit, no fix will make the upgrade supported. This page is written in English, but the commands and menu names work the same way in every language of Windows.

Will removing the bypass leftovers delete my files or apps?

No. Fix 1 deletes two registry keys, one policy value, one WMI filter, one script file in C:\Scripts and Setup's temporary folder $WINDOWS.~BT. None of them hold your documents, photos or programs. The $WINDOWS.~BT folder contains only Setup's work files and logs from the failed attempt, and Setup creates it again on the next try. Copy the logs out first if you want to keep them. Back up the registry key as the fix says, so you can undo the change.

How do I upgrade from Windows 11 22H2 now?

Do not look for 22H2 any more. Microsoft's download page now offers Windows 11 version 26H2, and an upgrade from 22H2 goes straight to the current version. Run Fix 1 if a bypass was ever used, then open Settings and Windows Update and select Check for updates. If the new version is not offered, use the Installation Assistant from Microsoft's Download Windows 11 page. A PC that meets the requirements can take this route without any extra steps.

Can I still use the wmic command to delete the WMI filter?

Usually not. Microsoft has removed the WMIC utility from currently supported versions of Windows 11, and it is no longer available as an optional feature. That is why the old command with wmic fails on many PCs. WMI itself still works, so Fix 1 uses PowerShell instead: Get-CimInstance with the filter name, piped to Remove-CimInstance. On Windows 10, wmic may still be present, but the PowerShell line works there too.